Fatal trap 9: general protection fault in sctp_lower_sosend (2)

2 views

Skip to first unread message

syzbot

unread,

Aug 20, 2020, 9:15:23 AM8/20/20

to syzkaller-f...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: 311d63dc cache: don't use cache_purge_negative when renaming
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=12d1d60e900000
dashboard link: https://syzkaller.appspot.com/bug?extid=125df5bf9ae3bf9a206d
userspace arch: i386

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+125df5...@syzkaller.appspotmail.com

Fatal trap 9: general protection fault while in kernel mode
cpuid = 1; apic id = 01
instruction pointer = 0x20:0xffffffff82da86af
stack pointer = 0x0:0xfffffe00261f15d0
frame pointer = 0x0:0xfffffe00261f17a0
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 26660 (syz-executor.1)
trap number = 9
panic: general protection fault
cpuid = 1
time = 1597929280
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe00261f12a0
vpanic() at vpanic+0x1c7/frame 0xfffffe00261f1300
panic() at panic+0x43/frame 0xfffffe00261f1360
trap_fatal() at trap_fatal+0x4cd/frame 0xfffffe00261f13e0
trap() at trap+0xf7/frame 0xfffffe00261f1500
calltrap() at calltrap+0x8/frame 0xfffffe00261f1500
--- trap 0x9, rip = 0xffffffff82da86af, rsp = 0xfffffe00261f15d0, rbp = 0xfffffe00261f17a0 ---
sctp_lower_sosend() at sctp_lower_sosend+0x53df/frame 0xfffffe00261f17a0
sctp_sosend() at sctp_sosend+0x4fc/frame 0xfffffe00261f18d0
sosend() at sosend+0xc6/frame 0xfffffe00261f1940
kern_sendit() at kern_sendit+0x34b/frame 0xfffffe00261f19f0
sendit() at sendit+0x226/frame 0xfffffe00261f1a50
sys_sendto() at sys_sendto+0x5c/frame 0xfffffe00261f1ab0
ia32_syscall() at ia32_syscall+0x24e/frame 0xfffffe00261f1bf0
int0x80_syscall_common() at int0x80_syscall_common+0x9c/frame 0xfbfdbf78
KDB: enter: panic
[ thread pid 26660 tid 100599 ]
Stopped at kdb_enter+0x67: movq $0,0x1488d76(%rip)
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0
rax 0x12
rcx 0xfffffe0028800000
rdx 0x3ffff
rbx 0
rsp 0xfffffe00261f1280
rbp 0xfffffe00261f12a0
rsi 0x40001
rdi 0xffffffff810d8006 vprintf+0x176
r8 0
r9 0xffffffff
r10 0
r11 0xfffffe002690f610
r12 0xffffffff82068ef0 ddb_dbbe
r13 0
r14 0xffffffff81920d32
r15 0xffffffff81920d32
rip 0xffffffff810ccc07 kdb_enter+0x67
rflags 0x200082 kernphys+0x82
kdb_enter+0x67: movq $0,0x1488d76(%rip)
db> show proc
Process 26660 (syz-executor.1) at 0xfffff80004d01a40:
state: NORMAL
uid: 0 gids: 0, 0, 5
parent: pid 24288 at 0xfffff8001af19520
ABI: FreeBSD ELF32
arguments: /root/syz-executor.1
reaper: 0xfffff80004316000 reapsubtree: 1
sigparent: 20
vmspace: 0xfffffe00264f89e8
(map 0xfffffe00264f89e8)
(map.pmap 0xfffffe00264f8aa8)
(pmap 0xfffffe00264f8b08)
threads: 3
100400 RunQ syz-executor.1
100582 S uwait 0xfffff8001ac39600 syz-executor.1
100599 Run CPU 1 syz-executor.1
db> ps
pid ppid pgrp uid state wmesg wchan cmd
26667 26659 424 0 R CPU 0 dhclient
26660 24288 24288 0 R (threaded) syz-executor.1
100400 RunQ syz-executor.1
100582 S uwait 0xfffff8001ac39600 syz-executor.1
100599 Run CPU 1 syz-executor.1
26659 424 424 0 S wait 0xfffff8001ab44000 sh
26624 24309 24309 0 T (threaded) syz-executor.3
100102 RunQ syz-executor.3
25447 1 25447 65 Ss select 0xfffff80004b04940 dhclient
24867 1 24867 0 Ss select 0xfffff8001a729ec0 dhclient
24864 1 24864 0 Ss select 0xfffff800230c9bc0 dhclient
24852 1 24852 65 Ss select 0xfffff8001a7257c0 dhclient
24309 768 24309 0 Rs syz-executor.3
24308 1 24308 0 Ss select 0xfffff8001a725840 dhclient
24288 768 24288 0 Rs syz-executor.1
24274 1 24274 0 Ss select 0xfffff80004b03040 dhclient
768 766 766 0 S (threaded) syz-fuzzer
100086 S uwait 0xfffff80004835500 syz-fuzzer
100109 S uwait 0xfffff80004aced80 syz-fuzzer
100110 S uwait 0xfffff80004acee80 syz-fuzzer
100111 S uwait 0xfffff80004acd000 syz-fuzzer
100112 S uwait 0xfffff8000409da80 syz-fuzzer
100113 S uwait 0xfffff8000409db80 syz-fuzzer
100114 S uwait 0xfffff80004833080 syz-fuzzer
100116 S uwait 0xfffff80004acba80 syz-fuzzer
100117 S kqread 0xfffff80004ad1b00 syz-fuzzer
766 764 766 0 Ss pause 0xfffff80004d2c0a8 csh
764 682 764 0 Ss select 0xfffff8001a7282c0 sshd
748 1 748 0 Ss+ ttyin 0xfffff8000481b8b0 getty
747 1 747 0 Ss+ ttyin 0xfffff80004bef8b0 getty
746 1 746 0 Ss+ ttyin 0xfffff80004bf20b0 getty
745 1 745 0 Ss+ ttyin 0xfffff80004bf28b0 getty
744 1 744 0 Ss+ ttyin 0xfffff800043a90b0 getty
743 1 743 0 Ss+ ttyin 0xfffff800043a98b0 getty
742 1 742 0 Ss+ ttyin 0xfffff800043ac0b0 getty
741 1 741 0 Ss+ ttyin 0xfffff800043ac8b0 getty
740 1 740 0 Ss+ ttyin 0xfffff800043ab0b0 getty
686 1 686 0 Ss nanslp 0xffffffff825290e0 cron
682 1 682 0 Ss select 0xfffff800041f4340 sshd
495 1 495 0 Ss select 0xfffff800041f45c0 syslogd
424 1 424 0 Ss wait 0xfffff80004e8b520 devd
423 1 423 65 Ss select 0xfffff80004b03a40 dhclient
338 1 338 0 Ss select 0xfffff80004b03b40 dhclient
335 1 335 0 Ss select 0xfffff800041f4640 dhclient
23 0 0 0 DL vlruwt 0xfffff800043da520 [vnlru]
22 0 0 0 DL syncer 0xffffffff826161e8 [syncer]
21 0 0 0 DL (threaded) [bufdaemon]
100070 D qsleep 0xffffffff82615530 [bufdaemon]
100077 D - 0xffffffff8200aa00 [bufspacedaemon-0]
100088 D sdflush 0xfffff800044234e8 [/ worker]
20 0 0 0 DL psleep 0xffffffff8263c608 [vmdaemon]
19 0 0 0 DL (threaded) [pagedaemon]
100068 D psleep 0xffffffff82630ab8 [dom0]
100075 D launds 0xffffffff82630ac4 [laundry: dom0]
100076 D umarcl 0xffffffff814c8db0 [uma]
18 0 0 0 DL - 0xffffffff8235cd08 [rand_harvestq]
17 0 0 0 DL waiting 0xffffffff82e0c2f8 [sctp_iterator]
16 0 0 0 DL pftm 0xffffffff82c4a390 [pf purge]
15 0 0 0 DL - 0xffffffff82614b2c [soaiod4]
9 0 0 0 DL - 0xffffffff82614b2c [soaiod3]
8 0 0 0 DL - 0xffffffff82614b2c [soaiod2]
7 0 0 0 DL - 0xffffffff82614b2c [soaiod1]
6 0 0 0 DL (threaded) [cam]
100034 D - 0xffffffff82234a40 [doneq0]
100067 D - 0xffffffff82234910 [scanner]
5 0 0 0 DL crypto_ 0xfffff80004226d90 [crypto returns 1]
4 0 0 0 DL crypto_ 0xfffff80004226d30 [crypto returns 0]
3 0 0 0 DL crypto_ 0xffffffff8262e0e0 [crypto]
14 0 0 0 DL seqstat 0xfffff800040dc488 [sequencer 00]
13 0 0 0 DL (threaded) [geom]
100025 D - 0xffffffff82508050 [g_event]
100026 D - 0xffffffff82508058 [g_up]
100027 D - 0xffffffff82508060 [g_down]
2 0 0 0 DL (threaded) [KTLS]
100018 D - 0xfffff800040ec100 [thr_0]
100019 D - 0xfffff800040ec180 [thr_1]
12 0 0 0 WL (threaded) [intr]
100011 I [swi6: task queue]
100012 I [swi6: Giant taskq]
100015 I [swi5: fast taskq]
100020 I [swi4: clock (0)]
100021 I [swi4: clock (1)]
100022 I [swi1: netisr 0]
100023 I [swi3: vm]
100035 I [irq24: virtio_pci0]
100036 I [irq25: virtio_pci0]
100037 I [irq26: virtio_pci0]
100038 I [irq27: virtio_pci0]
100039 I [irq28: virtio_pci1]
100040 I [irq29: virtio_pci1]
100041 I [irq30: virtio_pci1]
100042 I [irq31: virtio_pci1]
100043 I [irq32: virtio_pci1]
100048 I [irq10: virtio_pci2]
100050 I [irq1: atkbd0]
100051 I [irq12: psm0]
100052 I [swi0: uart uart++]
100060 I [swi1: pf send]
100073 I [swi1: hpts]
100074 I [swi1: hpts]
11 0 0 0 RL (threaded) [idle]
100003 CanRun [idle: cpu0]
100004 CanRun [idle: cpu1]
1 0 1 0 SLs wait 0xfffff80004316000 [init]
10 0 0 0 DL audit_w 0xffffffff8262e4f8 [audit]
0 0 0 0 DLs (threaded) [kernel]
100000 D swapin 0xffffffff825085f0 [swapper]
100005 D - 0xfffff80004345100 [softirq_0]
100006 D - 0xfffff80004345000 [softirq_1]
100007 D - 0xfffff80004346e00 [if_io_tqg_0]
100008 D - 0xfffff80004346d00 [if_io_tqg_1]
100009 D - 0xfffff80004346c00 [if_config_tqg_0]
100010 D - 0xfffff80004219e00 [aiod_kick taskq]
100013 D - 0xfffff80004219b00 [in6m_free taskq]
100014 D - 0xfffff80004219a00 [thread taskq]
100016 D - 0xfffff80004219800 [inm_free taskq]
100017 D - 0xfffff80004219700 [kqueue_ctx taskq]
100024 D - 0xfffff80004219600 [firmware taskq]
100029 D - 0xfffff80004219400 [crypto_0]
100030 D - 0xfffff80004219400 [crypto_1]
100044 D - 0xfffff80004219100 [vtnet0 rxq 0]
100045 D - 0xfffff80004219000 [vtnet0 txq 0]
100046 D - 0xfffff80004218e00 [vtnet0 rxq 1]
100047 D - 0xfffff80004218d00 [vtnet0 txq 1]
100049 D vtbslp 0xfffff800045de700 [virtio_balloon]
100053 D - 0xfffff80004218b00 [mca taskq]
100057 D - 0xffffffff81cc6560 [deadlkres]
100062 D - 0xfffff80004bb6000 [acpi_task_0]
100063 D - 0xfffff80004bb6000 [acpi_task_1]
100064 D - 0xfffff80004bb6000 [acpi_task_2]
100066 D - 0xfffff80004219200 [CAM taskq]
db> show all locks
Process 26667 (dhclient) thread 0xfffffe002690c000 (101110)
exclusive sx vm map (user) (vm map (user)) r = 0 (0xfffffe0026932a48) locked @ /syzkaller/managers/i386/kernel/sys/vm/vm_map.c:4707
Process 26660 (syz-executor.1) thread 0xfffffe002690f100 (100599)
exclusive sleep mutex sctp-send-tcb (tcbs) r = 0 (0xfffffe00268953a0) locked @ /syzkaller/managers/i386/kernel/sys/netinet/sctp_output.c:13130
db> show malloc
Type InUse MemUse Requests
pf_hash 5 11524K 5
devbuf 4213 4850K 4241
sctp_stro 73 4168K 7688
tcp_hpts 5 3201K 5
vtbuf 24 1968K 46
sysctloid 28062 1637K 28126
kobj 335 1340K 494
newblk 45 1035K 73503
vfscache 4 1025K 4
pcb 169 699K 39619
inodedep 29 526K 30382
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 472K 4
subproc 137 261K 26750
acpica 1674 185K 52414
vnet_data 1 168K 1
pagedep 17 132K 25949
tfo_ccache 1 128K 1
sem 4 106K 4
DEVFS1 105 105K 122
linker 254 99K 326
filedesc 12 81K 51051
bus 979 79K 3406
sctp_atcl 146 73K 24453
mtx_pool 2 72K 2
syncache 1 68K 1
acpitask 1 64K 1
ddb_capture 1 64K 1
module 505 64K 505
BPF 30 53K 94
umtx 360 45K 360
temp 36 35K 6912
vmem 3 34K 5
kdtrace 175 34K 98259
hostcache 1 32K 1
shm 1 32K 110
DEVFS3 124 31K 134
ifaddr 86 31K 112
msg 4 30K 4
DEVFS_RULE 56 27K 56
gtaskqueue 18 26K 18
kbdmux 6 22K 6
ufs_mount 5 17K 6
proc 3 17K 3
tty 16 16K 16
tidhash 1 16K 1
ithread 99 16K 99
bus-sc 30 14K 1405
KTRACE 100 13K 100
ifnet 7 13K 7
lltable 36 12K 779
kenv 92 12K 92
eventhandler 132 12K 132
ether_multi 136 11K 437
pfs_nodes 20 10K 20
GEOM 60 10K 489
select 77 10K 77
rman 82 10K 423
sctp_atky 219 10K 33452
sctp_timw 36 9K 36
bmsafemap 3 9K 31578
in6_multi 63 9K 229
UART 12 9K 12
devstat 4 9K 4
rpc 2 8K 2
shmfd 1 8K 42
pfs_vncache 1 8K 1
audit_evclass 233 8K 291
cred 27 7K 1393
routetbl 26 7K 1442
pf_osfp 58 7K 58
CAM DEV 3 6K 510
kqueue 57 6K 26672
vt 11 6K 11
pf_ifnet 15 6K 431
plimit 21 6K 1126
pf_rule 6 6K 569
sglist 5 6K 5
CAM queue 5 6K 1528
taskqueue 48 6K 48
ufs_dirhash 24 5K 24
freework 17 5K 46987
UMA 250 5K 250
pf_table 2 4K 352
memdesc 1 4K 1
MCA 32 4K 32
evdev 4 4K 4
lockf 32 4K 7921
session 27 4K 86
pgrp 27 4K 115
hhook 13 4K 13
sctp_ifa 23 3K 49
acpisem 22 3K 22
terminal 11 3K 11
uidinfo 5 3K 97
DEVFSP 40 3K 291
proc-args 46 3K 1043
sctp_athm 146 3K 25302
sctp_map 146 3K 15216
mkdir 17 3K 51366
local_apic 1 2K 1
io_apic 1 2K 1
ipsec-saq 2 2K 2
kcovinfo 32 2K 255
ip6ndp 12 2K 41
Unitno 35 2K 87716
dirrem 7 2K 29339
diradd 14 2K 29425
sctp_aadr 26 2K 237
CAM XPT 22 2K 543
newdirblk 10 2K 25683
ipsecpolicy 2 2K 2
acpidev 20 2K 20
msi 9 2K 9
clone 9 2K 9
tun 7 2K 7
softdep 1 1K 1
freeblks 4 1K 29337
sahead 1 1K 1
secasvar 1 1K 1
in_multi 4 1K 32
vnodemarker 2 1K 1232
NFSD session 1 1K 1
CAM periph 4 1K 271
nhops 6 1K 7
ipsec 3 1K 3
freefile 6 1K 29216
mld 6 1K 6
igmp 6 1K 6
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 89
pci_link 10 1K 10
encap_export_host 12 1K 12
crypto 3 1K 3
sctp_ifn 4 1K 49
sctp_stri 1 1K 1578
pfil 4 1K 4
chacha20random 1 1K 1
CAM SIM 2 1K 2
cdev 2 1K 2
inpcbpolicy 10 1K 12469
osd 3 1K 9
indirdep 1 1K 21763
vnodes 1 1K 291
ktls 1 1K 1
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
feeder 7 1K 7
ip_msource 3 1K 74
loginclass 3 1K 6
prison 6 1K 6
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
apmdev 1 1K 1
atkbddev 2 1K 2
CAM path 4 1K 1034
tcpfunc 2 1K 2
soname 5 1K 25434
pmchooks 1 1K 1
nexusdev 5 1K 5
sctp_vrf 1 1K 1
entropy 2 1K 68
vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1
filecaps 3 1K 175
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1
sctp_mcore 0 0K 0
sctp_socko 0 0K 11906
sctp_iter 0 0K 67
sctp_mvrf 0 0K 0
sctp_cpal 0 0K 24
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_a_it 0 0K 50
pf_altq 0 0K 0
pf_temp 0 0K 0
ath_hal 0 0K 0
madt_table 0 0K 2
athdev 0 0K 0
ata_pci 0 0K 0
ata_dma 0 0K 0
ata_generic 0 0K 0
amr 0 0K 0
scsi_da 0 0K 69
ata_da 0 0K 0
pvscsi 0 0K 0
smartpqi 0 0K 0
scsi_ch 0 0K 0
scsi_cd 0 0K 0
USBdev 0 0K 0
USB 0 0K 0
AHCI driver 0 0K 0
agp 0 0K 0
iavf 0 0K 0
ixl 0 0K 0
nvme_da 0 0K 0
acpipwr 0 0K 0
twsbuf 0 0K 0
twe_commands 0 0K 0
twa_commands 0 0K 0
tcp_log_dev 0 0K 211
ice-resmgr 0 0K 0
ice-osdep 0 0K 0
ice 0 0K 0
fpukern_ctx 0 0K 0
midi buffers 0 0K 0
xen_intr 0 0K 0
mixer 0 0K 0
xen_hvm 0 0K 0
legacydrv 0 0K 0
qpidrv 0 0K 0
ac97 0 0K 0
hdacc 0 0K 0
dmar_idpgtbl 0 0K 0
dmar_dom 0 0K 0
dmar_ctx 0 0K 0
hdac 0 0K 0
hdaa 0 0K 0
acpi_perf 0 0K 0
isci 0 0K 0
iommu_dmamap 0 0K 0
hyperv_socket 0 0K 0
bxe_ilt 0 0K 0
xenbus 0 0K 0
acpicmbat 0 0K 0
SIIS driver 0 0K 0
vm_fictitious 0 0K 0
CAM CCB 0 0K 93788
PUC 0 0K 0
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
tempbuff 0 0K 0
UMAHash 0 0K 0
ag_tgt_map_t malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
savedino 0 0K 15727
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 617
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freefrag 0 0K 293
allocindir 0 0K 0
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
xform 0 0K 0
lDevFlags * malloc 0 0K 0
NLM 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6opt 0 0K 491
ip6_msource 0 0K 0
ip6_moptions 0 0K 11
in6_mfilter 0 0K 0
frag6 0 0K 0
tcplog 0 0K 0
tiDeviceHandle_t * malloc 0 0K 0
LRO 0 0K 0
newreno data 0 0K 0
ip_moptions 0 0K 106
in_mfilter 0 0K 169
ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
fadvise 0 0K 0
ag_portal_data_t malloc 0 0K 0
statfs 0 0K 25849
export_host 0 0K 0
cl_savebuf 0 0K 106
ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
CCB List 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
CAM ccb queue 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
mps_user 0 0K 0
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
MPSSAS 0 0K 0
mbuf_tag 0 0K 971
accf 0 0K 0
pts 0 0K 0
iov 0 0K 30752
ioctlops 0 0K 1730
Witness 0 0K 0
stack 0 0K 0
mps 0 0K 0
mpr_user 0 0K 0
MPRSAS 0 0K 0
mpr 0 0K 0
mfibuf 0 0K 0
md_sectors 0 0K 0
sbuf 0 0K 288
md_disk 0 0K 0
firmware 0 0K 0
compressor 0 0K 0
malodev 0 0K 0
SWAP 0 0K 0
LED 0 0K 0
sysctltmp 0 0K 1311
sysctl 0 0K 1
ekcd 0 0K 0
dumper 0 0K 0
sendfile 0 0K 707
rctl 0 0K 0
ix_sriov 0 0K 0
aacraidcam 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
iirbuf 0 0K 0
cache 0 0K 0
aacraid_buf 0 0K 0
prison_racct 0 0K 0
Fail Points 0 0K 0
sigio 0 0K 36
filedesc_to_leader 0 0K 0
pwd 0 0K 0
tty console 0 0K 0
aaccam 0 0K 0
aacbuf 0 0K 0
zstd 0 0K 0
nvlist 0 0K 0
SCSI ENC 0 0K 0
SCSI sa 0 0K 0
isofs_node 0 0K 0
isofs_mount 0 0K 0
tr_raid5_data 0 0K 0
tr_raid1e_data 0 0K 0
tr_raid1_data 0 0K 0
tr_raid0_data 0 0K 0
tr_concat_data 0 0K 0
md_sii_data 0 0K 0
md_promise_data 0 0K 0
md_nvidia_data 0 0K 0
md_jmicron_data 0 0K 0
md_intel_data 0 0K 0
md_ddf_data 0 0K 0
raid_data 0 0K 72
geom_flashmap 0 0K 0
tmpfs name 0 0K 0
tmpfs mount 0 0K 0
NFS FHA 0 0K 0
newnfsmnt 0 0K 0
newnfsclient_req 0 0K 0
NFSCL layrecall 0 0K 0
NFSCL session 0 0K 0
NFSCL sockreq 0 0K 0
NFSCL devinfo 0 0K 0
NFSCL flayout 0 0K 0
NFSCL layout 0 0K 0
NFSD rollback 0 0K 0
NFSCL diroffdiroff 0 0K 0
NEWdirectio 0 0K 0
NEWNFSnode 0 0K 0
NFSCL lck 0 0K 0
NFSCL lckown 0 0K 0
NFSCL client 0 0K 0
NFSCL deleg 0 0K 0
NFSCL open 0 0K 0
NFSCL owner 0 0K 0
NFS fh 0 0K 0
NFS req 0 0K 0
NFSD usrgroup 0 0K 0
NFSD string 0 0K 0
NFSD V4lock 0 0K 0
NFSD V4state 0 0K 0
NFSD srvcache 0 0K 0
msdosfs_fat 0 0K 0
msdosfs_mount 0 0K 0
msdosfs_node 0 0K 0
DEVFS4 0 0K 0
DEVFS2 0 0K 0
gntdev 0 0K 0
privcmd_dev 0 0K 0
evtchn_dev 0 0K 0
xenstore 0 0K 0
scsi_pass 0 0K 0
ciss_data 0 0K 0
xnb 0 0K 0
xbbd 0 0K 0
xbd 0 0K 0
Balloon 0 0K 0
sysmouse 0 0K 0
vtfont 0 0K 0
db> show uma
Zone Size Used Free Requests Sleeps Bucket Total Mem XFree
mbuf_cluster 2048 9780 380 9785 0 254 20807680 0
mbuf_jumbo_page 4096 462 4110 73505 0 254 18726912 0
65536 65536 1 110 111 0 1 7274496 0
tcp_log 416 0 15498 580592 0 254 6447168 0
32768 32768 0 112 112 0 1 3670016 0
RADIX NODE 144 6466 11031 1113020 0 63 2519568 0
mbuf_packet 256 8222 1430 286105 0 254 2470912 0
512 512 4360 176 30978 0 30 2322432 0
16384 16384 0 136 136 0 1 2228224 0
BUF TRIE 144 361 13107 49363 0 62 1939392 0
sctp_asoc 2288 73 692 7608 0 254 1750320 0
mbuf 256 1016 5592 1611793 0 254 1691648 0
4096 4096 349 46 989 0 2 1617920 0
UMA Slabs 0 112 12376 2 12376 0 126 1386336 0
128 128 9182 149 9235 0 126 1194368 0
g_bio 408 0 2490 372806 0 30 1015920 0
sctp_ep 1280 72 690 16048 0 254 975360 0
pbuf 832 0 889 0 0 2 739648 0
socket 960 28 736 35782 0 254 733440 0
8192 8192 1 81 82 0 1 671744 0
256 Bucket 2048 302 22 4482 0 8 663552 0
65536 65536 6 3 13 0 1 589824 0
tcp_bbr_map 128 0 4557 266491 0 126 583296 0
sctp_raddr 736 73 697 8542 0 254 566720 0
2048 2048 9 263 94685 0 8 557056 0
tcpcb 1040 5 512 8444 0 254 537680 0
VM OBJECT 264 1271 259 400091 0 30 403920 0
VNODE 496 602 94 30139 0 30 345216 0
THREAD 1792 145 35 45003 0 8 322560 0
4096 4096 61 17 52534 0 2 319488 0
2048 2048 75 69 16929 0 8 294912 0
1024 1024 203 85 7765 0 16 294912 0
256 256 46 1019 89231 0 62 272640 0
32768 32768 0 8 18866 0 1 262144 0
ripcb 488 3 509 731 0 254 249856 0
udplite_inpcb 488 0 512 2303 0 254 249856 0
tcp_inpcb 488 5 507 8444 0 254 249856 0
udp_inpcb 488 2 510 991 0 254 249856 0
128 Bucket 1024 184 27 5509 0 16 216064 0
16384 16384 5 8 25519 0 1 212992 0
64 64 2706 381 2721 0 254 197568 0
65536 65536 1 2 219 0 1 196608 0
32768 32768 1 5 7 0 1 196608 0
128 128 1320 199 26285 0 126 194432 0
MAP ENTRY 96 1294 722 1568215 0 126 193536 0
16 16 11798 202 11930 0 254 192000 0
512 512 33 327 32217 0 30 184320 0
FFS2 dinode 256 565 125 30100 0 62 176640 0
UMA Zones 768 225 2 225 0 16 174336 0
64 Bucket 512 99 229 17398 0 30 167936 0
vmem btag 56 2753 186 2753 0 254 164584 0
512 512 13 307 1042 0 30 163840 0
256 256 207 423 30974 0 62 161280 0
32 32 4425 489 4455 0 254 157248 0
1024 1024 12 140 283 0 16 155648 0
VMSPACE 2536 32 22 26663 0 4 136944 0
65536 65536 0 2 967 0 1 131072 0
32768 32768 2 2 4 0 1 131072 0
unpcb 256 14 496 7094 0 254 130560 0
FFS inode 160 565 185 30100 0 62 120000 0
sctp_chunk 152 66 714 7703 0 254 118560 0
ksiginfo 112 65 979 775 0 126 116928 0
128 128 581 318 53529 0 126 115072 0
128 128 477 422 63535 0 126 115072 0
clpbuf 832 0 128 1926 0 16 106496 0
PROC 1312 54 27 26667 0 8 106272 0
S VFS Cache 104 627 387 31687 0 126 105456 0
16384 16384 4 2 8 0 1 98304 0
filedesc0 1080 55 29 26668 0 8 90720 0
syncache 168 0 528 8 0 254 88704 0
64 64 666 657 24668 0 254 84672 0
UMA Kegs 384 211 5 211 0 30 82944 0
256 256 136 179 102924 0 62 80640 0
256 256 124 191 43479 0 62 80640 0
32 Bucket 256 164 151 32533 0 62 80640 0
sctp_readq 152 0 520 470 0 254 79040 0
512 512 92 60 211 0 30 77824 0
128 128 341 248 26350 0 126 75392 0
8192 8192 6 3 34 0 1 73728 0
8192 8192 6 3 9 0 1 73728 0
256 256 77 193 47869 0 62 69120 0
64 64 398 673 14325 0 254 68544 0
128 128 222 305 7129 0 126 67456 0
65536 65536 1 0 1 0 1 65536 0
16384 16384 4 0 7 0 1 65536 0
2048 2048 0 32 32 0 8 65536 0
256 256 64 191 36676 0 62 65280 0
256 256 113 142 2755 0 62 65280 0
512 512 40 80 573 0 30 61440 0
sctp_stream_msg_out 112 28 512 1261 0 254 60480 0
4096 4096 12 2 23 0 2 57344 0
4096 4096 9 5 14 0 2 57344 0
hostcache 96 2 544 2 0 254 52416 0
64 64 113 706 53528 0 254 52416 0
64 64 469 350 1314 0 254 52416 0
pipe 760 15 50 2880 0 16 49400 0
DIRHASH 1024 34 14 34 0 16 49152 0
NAMEI 1024 0 48 140980 0 16 49152 0
8192 8192 1 5 13 0 1 49152 0
2048 2048 10 14 363 0 8 49152 0
2048 2048 9 15 232 0 8 49152 0
1024 1024 1 47 202 0 16 49152 0
Files 80 157 393 86747 0 126 44000 0
4096 4096 3 7 88 0 2 40960 0
64 pcpu 8 4238 370 10557 0 254 36864 0
selfd 64 149 418 191879 0 254 36288 0
64 64 49 518 378 0 254 36288 0
64 64 36 531 380 0 254 36288 0
64 64 19 548 7135 0 254 36288 0
32 32 241 893 25364 0 254 36288 0
8 Bucket 80 112 338 66396 0 126 36000 0
128 128 41 238 113 0 126 35712 0
128 128 46 233 262 0 126 35712 0
routing nhops 256 13 122 81 0 62 34560 0
ttyoutq 256 72 63 160 0 62 34560 0
256 256 27 108 146 0 62 34560 0
TURNSTILE 136 181 71 181 0 62 34272 0
SLEEPQUEUE 88 181 203 181 0 126 33792 0
8192 8192 1 3 36 0 1 32768 0
4096 4096 1 7 47 0 2 32768 0
2048 2048 5 11 549 0 8 32768 0
1024 1024 5 27 2279 0 16 32768 0
1024 1024 7 25 323 0 16 32768 0
1024 1024 11 21 414 0 16 32768 0
512 512 1 63 119 0 30 32768 0
512 512 1 63 91 0 30 32768 0
mt_stats_zone 64 445 67 445 0 254 32768 0
ipq 56 0 576 5 0 254 32256 0
16 Bucket 144 69 155 50292 0 62 32256 0
2 Bucket 32 328 680 21305 0 254 32256 0
KNOTE 160 16 184 249332 0 62 32000 0
ttyinq 160 135 65 300 0 62 32000 0
tcp_log_node 120 0 264 5 0 126 31680 0
tcp_bbr_pcb 832 0 36 1382 0 16 29952 0
cpuset 104 7 272 7 0 126 29016 0
pf tags 104 0 273 84 0 126 28392 0
sctp_asconf_ack 48 0 588 57 0 254 28224 0
sctp_laddr 48 28 560 2445 0 254 28224 0
PWD 32 17 865 25640 0 254 28224 0
32 32 274 608 89413 0 254 28224 0
32 32 38 844 49246 0 254 28224 0
4 Bucket 48 7 581 6173 0 254 28224 0
rtentry 208 23 110 81 0 62 27664 0
8192 8192 1 2 13 0 1 24576 0
8192 8192 3 0 3 0 1 24576 0
tcp_log_bucket 176 0 138 5 0 62 24288 0
rl_entry 40 93 513 111 0 254 24240 0
vtnet_tx_hdr 24 0 1002 819002 0 254 24048 0
udpcb 32 2 628 3294 0 254 20160 0
32 32 82 548 372 0 254 20160 0
32 32 67 563 1061 0 254 20160 0
32 32 58 572 4154 0 254 20160 0
32 32 10 620 492 0 254 20160 0
procdesc 136 3 142 26 0 62 19720 0
epoch_record pcpu 256 4 60 4 0 62 16384 0
4096 4096 0 4 436 0 2 16384 0
2048 2048 0 8 12 0 8 16384 0
1024 1024 2 14 42 0 16 16384 0
512 512 11 21 11 0 30 16384 0
SMR CPU 32 2 509 2 0 254 16352 0
rentr 24 0 668 125 0 254 16032 0
mt_zone 24 445 223 445 0 254 16032 0
16 16 176 824 25489 0 254 16000 0
16 16 165 835 42658 0 254 16000 0
VNODEPOLL 120 0 132 9 0 126 15840 0
KMAP ENTRY 96 12 153 12 0 126 15840 0
kenv 258 3 57 1028 0 30 15480 0
FPU_save_area 832 1 17 1 0 16 14976 0
vmem 1856 1 7 1 0 8 14848 0
SMR SHARED 24 2 509 2 0 254 12264 0
16 16 300 450 1099 0 254 12000 0
16 16 11 739 17811 0 254 12000 0
16 16 186 564 1232 0 254 12000 0
16 16 7 743 42 0 254 12000 0
Mountpoints 2816 2 2 2 0 4 11264 0
8192 8192 1 0 1 0 1 8192 0
4096 4096 0 2 2 0 2 8192 0
16 16 15 485 15 0 254 8000 0
UMA Slabs 1 176 9 13 9 0 62 3872 0
int pcpu 4 18 494 18 0 254 2048 0
tfo 4 0 493 8 0 254 1972 0
FFS1 dinode 128 0 0 0 0 126 0 0
swblk 136 0 0 0 0 62 0 0
swpctrie 144 0 0 0 0 62 0 0
sctp_asconf 40 0 0 0 0 254 0 0
pf state scrubs 40 0 0 0 0 254 0 0
pf frag entries 40 0 0 0 0 254 0 0
pf frags 248 0 0 0 0 62 0 0
pf table entries 160 0 0 0 0 62 0 0
pf table entry counters 64 0 0 0 0 254 0 0
pf source nodes 136 0 0 0 0 254 0 0
pf state keys 88 0 0 0 0 126 0 0
pf states 296 0 0 0 0 0 0 0
pf mtags 48 0 0 0 0 254 0 0
tcpreass 48 0 0 0 0 254 0 0
tfo_ccache_entries 80 0 0 0 0 126 0 0
sackhole 32 0 0 0 0 254 0 0
tcptw 88 0 0 0 0 254 0 0
IPsec SA lft_c 16 0 0 0 0 254 0 0
itimer 352 0 0 0 0 30 0 0
AIOLIO 280 0 0 0 0 30 0 0
AIOCB 752 0 0 0 0 16 0 0
AIOP 32 0 0 0 0 254 0 0
AIO 208 0 0 0 0 62 0 0
NCLNODE 592 0 0 0 0 16 0 0
TMPFS node 232 0 0 0 0 62 0 0
TMPFS dirent 64 0 0 0 0 254 0 0
LTS VFS Cache 360 0 0 0 0 30 0 0
L VFS Cache 320 0 0 0 0 30 0 0
STS VFS Cache 144 0 0 0 0 62 0 0
crypto_session 72 0 0 0 0 126 0 0
cryptop 280 0 0 0 0 30 0 0
nvme_request 128 0 0 0 0 126 0 0
IOMMU_MAP_ENTRY 120 0 0 0 0 126 0 0
ktls_session 192 0 0 0 0 62 0 0
mbuf_jumbo_16k 16384 0 0 0 0 254 0 0
mbuf_jumbo_9k 9216 0 0 0 0 254 0 0
audit_record 1280 0 0 0 0 8 0 0
domainset 40 0 0 0 0 254 0 0
MAC labels 40 0 0 0 0 254 0 0
vnpbuf 832 0 0 0 0 62 0 0
mdpbuf 832 0 0 0 0 4 0 0
nfspbuf 832 0 0 0 0 16 0 0
swwbuf 832 0 0 0 0 8 0 0
swrbuf 832 0 0 0 0 16 0 0
umtx_shm 88 0 0 0 0 126 0 0
umtx pi 96 0 0 0 0 126 0 0
rangeset pctrie nodes 144 0 0 0 0 62 0 0
65536 65536 0 0 0 0 1 0 0
65536 65536 0 0 0 0 1 0 0
65536 65536 0 0 0 0 1 0 0
32768 32768 0 0 0 0 1 0 0
32768 32768 0 0 0 0 1 0 0
32768 32768 0 0 0 0 1 0 0
32768 32768 0 0 0 0 1 0 0
16384 16384 0 0 0 0 1 0 0
16384 16384 0 0 0 0 1 0 0
16384 16384 0 0 0 0 1 0 0
16384 16384 0 0 0 0 1 0 0
2048 2048 0 0 0 0 8 0 0
1024 1024 0 0 0 0 16 0 0
fakepg 104 0 0 0 0 126 0 0
UMA Hash 256 0 0 0 0 62 0 0

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

Aug 24, 2020, 6:04:18 PM8/24/20

to syzkaller-f...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: 4f1f3fbe bhyve: NVMe queue create must init head/tail
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=139b9dee900000

dashboard link: https://syzkaller.appspot.com/bug?extid=125df5bf9ae3bf9a206d
userspace arch: i386

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=172a650e900000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+125df5...@syzkaller.appspotmail.com

Fatal trap 9: general protection fault while in kernel mode

cpuid = 0; apic id = 00
instruction pointer = 0x20:0xffffffff82ca16af
stack pointer = 0x0:0xfffffe002663b640
frame pointer = 0x0:0xfffffe002663b810

code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0

current process = 1885 (syz-executor.0)

trap number = 9
panic: general protection fault

cpuid = 0
time = 1598306475
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe002663b310
vpanic() at vpanic+0x1c7/frame 0xfffffe002663b370
panic() at panic+0x43/frame 0xfffffe002663b3d0
trap_fatal() at trap_fatal+0x4cd/frame 0xfffffe002663b450
trap() at trap+0xf7/frame 0xfffffe002663b570
calltrap() at calltrap+0x8/frame 0xfffffe002663b570
--- trap 0x9, rip = 0xffffffff82ca16af, rsp = 0xfffffe002663b640, rbp = 0xfffffe002663b810 ---
sctp_lower_sosend() at sctp_lower_sosend+0x53df/frame 0xfffffe002663b810
sctp_sosend() at sctp_sosend+0x4fc/frame 0xfffffe002663b940
sosend() at sosend+0xc6/frame 0xfffffe002663b9b0
soo_write() at soo_write+0x61/frame 0xfffffe002663b9f0
dofilewrite() at dofilewrite+0xb0/frame 0xfffffe002663ba40
kern_writev() at kern_writev+0x66/frame 0xfffffe002663ba80
freebsd32_writev() at freebsd32_writev+0x53/frame 0xfffffe002663bab0
ia32_syscall() at ia32_syscall+0x24e/frame 0xfffffe002663bbf0

int0x80_syscall_common() at int0x80_syscall_common+0x9c/frame 0xfbfdbf78
KDB: enter: panic

[ thread pid 1885 tid 100227 ]
Stopped at kdb_enter+0x67: movq $0,0x1488be6(%rip)

db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0
rax 0x12

rcx 0x80 ll+0x5f
rdx 0xffffffff818dfbcb
rbx 0
rsp 0xfffffe002663b2f0
rbp 0xfffffe002663b310
rsi 0x1
rdi 0
r8 0
r9 0xffffffff
r10 0x5afbb294af5521c0
r11 0xfffffe0027329c10

r12 0xffffffff82068ef0 ddb_dbbe
r13 0

r14 0xffffffff8192a193
r15 0xffffffff8192a193
rip 0xffffffff810cd297 kdb_enter+0x67
rflags 0x200086 kernphys+0x86
kdb_enter+0x67: movq $0,0x1488be6(%rip)
db> show proc
Process 1885 (syz-executor.0) at 0xfffff80019b3b520:

state: NORMAL
uid: 0 gids: 0, 0, 5

parent: pid 775 at 0xfffff80004d40000
ABI: FreeBSD ELF32
arguments: /root/syz-executor.0
reaper: 0xfffff800042ff000 reapsubtree: 1
sigparent: 20
vmspace: 0xfffffe002687d000
(map 0xfffffe002687d000)
(map.pmap 0xfffffe002687d0c0)
(pmap 0xfffffe002687d120)
threads: 3
100265 Run CPU 1 syz-executor.0
100226 S uwait 0xfffff80004306580 syz-executor.0
100227 Run CPU 0 syz-executor.0

db> ps
pid ppid pgrp uid state wmesg wchan cmd

1885 775 775 0 R (threaded) syz-executor.0
100265 Run CPU 1 syz-executor.0
100226 S uwait 0xfffff80004306580 syz-executor.0
100227 Run CPU 0 syz-executor.0
806 798 806 0 Ss select 0xfffff800045df240 dhclient
802 1 802 0 Ss select 0xfffff80004c332c0 dhclient
798 790 424 65 S select 0xfffff80004c36340 dhclient
790 424 424 0 S wait 0xfffff80004cd4000 sh
775 773 775 0 Rs syz-executor.0
773 771 771 0 S (threaded) syz-execprog
100081 S uwait 0xfffff8000482c380 syz-execprog
100106 S uwait 0xfffff8000482a580 syz-execprog
100107 S uwait 0xfffff8000482a900 syz-execprog
100108 S kqread 0xfffff800040db600 syz-execprog
100109 S uwait 0xfffff8000482ab00 syz-execprog
100110 S uwait 0xfffff80004302400 syz-execprog
100111 S uwait 0xfffff80004302500 syz-execprog
100319 S uwait 0xfffff80004a87980 syz-execprog
100320 S uwait 0xfffff80004a87300 syz-execprog
771 769 771 0 Ss pause 0xfffff800194d35c8 csh
769 682 769 0 Ss select 0xfffff80004c364c0 sshd
748 1 748 0 Ss+ ttyin 0xfffff8000484f4b0 getty
747 1 747 0 Ss+ ttyin 0xfffff80004bb00b0 getty
746 1 746 0 Ss+ ttyin 0xfffff80004bb04b0 getty
745 1 745 0 Ss+ ttyin 0xfffff80004bb08b0 getty
744 1 744 0 Ss+ ttyin 0xfffff80004bb0cb0 getty
743 1 743 0 Ss+ ttyin 0xfffff8000484e0b0 getty
742 1 742 0 Ss+ ttyin 0xfffff8000484e4b0 getty
741 1 741 0 Ss+ ttyin 0xfffff8000484e8b0 getty
740 1 740 0 Ss+ ttyin 0xfffff8000484ecb0 getty
738 1 24 0 S+ piperd 0xfffff80004cda5f0 logger
737 736 24 0 S+ nanslp 0xffffffff825295e1 sleep
736 1 24 0 S+ wait 0xfffff800194d3000 sh
686 1 686 0 Ss nanslp 0xffffffff825295e1 cron
682 1 682 0 Ss select 0xfffff80004c33d40 sshd
495 1 495 0 Ss select 0xfffff80004c33c40 syslogd
424 1 424 0 Ss wait 0xfffff80004b60520 devd
423 1 423 65 Ss select 0xfffff80004c33840 dhclient
338 1 338 0 Ss select 0xfffff80004c337c0 dhclient
335 1 335 0 Ss select 0xfffff80004c33f40 dhclient
23 0 0 0 DL vlruwt 0xfffff80004b9aa40 [vnlru]
22 0 0 0 DL syncer 0xffffffff826166e8 [syncer]

21 0 0 0 DL (threaded) [bufdaemon]

100070 D qsleep 0xffffffff82615a30 [bufdaemon]

100077 D - 0xffffffff8200aa00 [bufspacedaemon-0]

100088 D sdflush 0xfffff800045ee8e8 [/ worker]
20 0 0 0 DL psleep 0xffffffff8263cc48 [vmdaemon]

19 0 0 0 DL (threaded) [pagedaemon]

100068 D psleep 0xffffffff826310f8 [dom0]
100075 D launds 0xffffffff82631104 [laundry: dom0]
100076 D umarcl 0xffffffff814ce3d0 [uma]
18 0 0 0 DL - 0xffffffff8235d208 [rand_harvestq]
17 0 0 0 DL waiting 0xffffffff82d052f8 [sctp_iterator]
16 0 0 0 DL pftm 0xffffffff82e3f390 [pf purge]
15 0 0 0 DL - 0xffffffff8261502c [soaiod4]
9 0 0 0 DL - 0xffffffff8261502c [soaiod3]
8 0 0 0 DL - 0xffffffff8261502c [soaiod2]
7 0 0 0 DL - 0xffffffff8261502c [soaiod1]

6 0 0 0 DL (threaded) [cam]

100034 D - 0xffffffff82234f40 [doneq0]
100067 D - 0xffffffff82234e10 [scanner]
5 0 0 0 DL crypto_ 0xfffff800043cb090 [crypto returns 1]
4 0 0 0 DL crypto_ 0xfffff800043cb030 [crypto returns 0]
3 0 0 0 DL crypto_ 0xffffffff8262e5e0 [crypto]
14 0 0 0 DL seqstat 0xfffff80004364888 [sequencer 00]

13 0 0 0 DL (threaded) [geom]

100025 D - 0xffffffff82508550 [g_event]
100026 D - 0xffffffff82508558 [g_up]
100027 D - 0xffffffff82508560 [g_down]

2 0 0 0 DL (threaded) [KTLS]

100018 D - 0xfffff8000432c000 [thr_0]
100019 D - 0xfffff8000432c080 [thr_1]

12 0 0 0 WL (threaded) [intr]

100012 I [swi5: fast taskq]
100016 I [swi6: task queue]
100017 I [swi6: Giant taskq]

100020 I [swi4: clock (0)]
100021 I [swi4: clock (1)]
100022 I [swi1: netisr 0]
100023 I [swi3: vm]
100035 I [irq24: virtio_pci0]
100036 I [irq25: virtio_pci0]
100037 I [irq26: virtio_pci0]
100038 I [irq27: virtio_pci0]
100039 I [irq28: virtio_pci1]
100040 I [irq29: virtio_pci1]
100041 I [irq30: virtio_pci1]
100042 I [irq31: virtio_pci1]
100043 I [irq32: virtio_pci1]
100048 I [irq10: virtio_pci2]
100050 I [irq1: atkbd0]
100051 I [irq12: psm0]
100052 I [swi0: uart uart++]
100060 I [swi1: pf send]
100073 I [swi1: hpts]
100074 I [swi1: hpts]
11 0 0 0 RL (threaded) [idle]
100003 CanRun [idle: cpu0]
100004 CanRun [idle: cpu1]

1 0 1 0 SLs wait 0xfffff800042ff000 [init]
10 0 0 0 DL audit_w 0xffffffff8262eb00 [audit]

0 0 0 0 DLs (threaded) [kernel]

100000 D swapin 0xffffffff82508af0 [swapper]
100005 D - 0xfffff80004202000 [softirq_0]
100006 D - 0xfffff80004201d00 [softirq_1]
100007 D - 0xfffff80004201b00 [if_io_tqg_0]
100008 D - 0xfffff80004201900 [if_io_tqg_1]
100009 D - 0xfffff80004201700 [if_config_tqg_0]
100010 D - 0xfffff8000433b100 [in6m_free taskq]
100011 D - 0xfffff8000433b000 [thread taskq]
100013 D - 0xfffff8000433cd00 [inm_free taskq]
100014 D - 0xfffff8000433cc00 [kqueue_ctx taskq]
100015 D - 0xfffff8000433cb00 [aiod_kick taskq]
100024 D - 0xfffff8000433c800 [firmware taskq]
100029 D - 0xfffff80004339c00 [crypto_0]
100030 D - 0xfffff80004339c00 [crypto_1]
100044 D - 0xfffff80004802200 [vtnet0 rxq 0]
100045 D - 0xfffff80004802100 [vtnet0 txq 0]
100046 D - 0xfffff800045c6e00 [vtnet0 rxq 1]
100047 D - 0xfffff800045c6d00 [vtnet0 txq 1]
100049 D vtbslp 0xfffff800045df700 [virtio_balloon]
100053 D - 0xfffff8000485c300 [mca taskq]
100057 D - 0xffffffff81ccfa00 [deadlkres]
100063 D - 0xfffff80004841800 [acpi_task_0]
100064 D - 0xfffff80004841800 [acpi_task_1]
100065 D - 0xfffff80004841800 [acpi_task_2]
100066 D - 0xfffff80004339500 [CAM taskq]
db> show all locks
Process 1885 (syz-executor.0) thread 0xfffffe0027329e00 (100265)
exclusive sleep mutex umtxql (umtxql) r = 0 (0xffffffff82549450) locked @ /syzkaller/managers/i386/kernel/sys/kern/kern_umtx.c:512
Process 1885 (syz-executor.0) thread 0xfffffe0027329700 (100227)
exclusive sleep mutex sctp-send-tcb (tcbs) r = 0 (0xfffffe0027ba7ab0) locked @ /syzkaller/managers/i386/kernel/sys/netinet/sctp_output.c:13130

db> show malloc
Type InUse MemUse Requests

sctp_stro 1098 17568K 4328
pf_hash 5 11524K 5
devbuf 4214 4854K 4239
tcp_hpts 5 3201K 5
pcb 2226 3016K 13062

vtbuf 24 1968K 46
sysctloid 28062 1637K 28126
kobj 335 1340K 494

newblk 350 1112K 1472
sctp_atcl 2200 1100K 8656
inodedep 1134 1079K 1160
vfscache 4 1025K 4

ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 472K 4

dirrem 1096 274K 1109
subproc 125 245K 1959

acpica 1674 185K 52414
vnet_data 1 168K 1

sctp_atky 3298 138K 10820
freefile 1079 135K 1090
pagedep 17 132K 1103

tfo_ccache 1 128K 1
sem 4 106K 4

DEVFS1 102 102K 113
linker 254 99K 287
bus 975 79K 3338

mtx_pool 2 72K 2
syncache 1 68K 1
acpitask 1 64K 1
ddb_capture 1 64K 1
module 505 64K 505

umtx 306 39K 306
filedesc 5 37K 2179
BPF 19 36K 19
sctp_athm 2200 35K 8656
sctp_map 2196 35K 4328
vmem 3 34K 5
temp 23 33K 3807
kdtrace 169 33K 5991

hostcache 1 32K 1
shm 1 32K 1

DEVFS3 121 31K 131

msg 4 30K 4
DEVFS_RULE 56 27K 56
gtaskqueue 18 26K 18

sctp_timw 87 22K 87

kbdmux 6 22K 6
ufs_mount 5 17K 6
proc 3 17K 3

ifaddr 43 17K 43

tty 16 16K 16
tidhash 1 16K 1
ithread 99 16K 99
bus-sc 30 14K 1405
KTRACE 100 13K 100

kenv 92 12K 92
eventhandler 132 12K 132

pfs_nodes 20 10K 20
GEOM 60 10K 489

rman 82 10K 423
bmsafemap 4 9K 1129

UART 12 9K 12
devstat 4 9K 4
rpc 2 8K 2

shmfd 1 8K 1

pfs_vncache 1 8K 1
audit_evclass 233 8K 291

lltable 20 7K 20
ifnet 4 7K 4

CAM DEV 3 6K 510

ether_multi 73 6K 78
vt 11 6K 11
cred 22 6K 240
kqueue 54 6K 1890

sglist 5 6K 5
CAM queue 5 6K 1528
taskqueue 48 6K 48

in6_multi 41 5K 41
plimit 19 5K 344
ufs_dirhash 24 5K 24
UMA 250 5K 250

memdesc 1 4K 1
MCA 32 4K 32

diradd 32 4K 1125
evdev 4 4K 4
routetbl 18 4K 18
pf_ifnet 7 4K 10
hhook 13 4K 13
session 23 3K 34
pgrp 23 3K 34

acpisem 22 3K 22
terminal 11 3K 11

proc-args 44 3K 509
select 18 3K 18
uidinfo 3 3K 8

local_apic 1 2K 1
io_apic 1 2K 1
ipsec-saq 2 2K 2

lockf 19 2K 29

CAM XPT 22 2K 543

Unitno 26 2K 2302

ipsecpolicy 2 2K 2
acpidev 20 2K 20
msi 9 2K 9

mkdir 9 2K 2184
clone 9 2K 9
sctp_ifa 8 1K 10
softdep 1 1K 1
indirdep 4 1K 4

sahead 1 1K 1
secasvar 1 1K 1

vnodemarker 2 1K 6

NFSD session 1 1K 1

ip6ndp 6 1K 9

CAM periph 4 1K 271

newdirblk 7 1K 1092
ipsec 3 1K 3
in_multi 3 1K 4
nhops 6 1K 6

toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 89
pci_link 10 1K 10
encap_export_host 12 1K 12
crypto 3 1K 3

pfil 4 1K 4
chacha20random 1 1K 1
CAM SIM 2 1K 2
cdev 2 1K 2

sctp_ifn 3 1K 10
freework 2 1K 1107
mld 3 1K 3
igmp 3 1K 3
tun 4 1K 4
osd 3 1K 9
DEVFSP 5 1K 5
inpcbpolicy 9 1K 2311
freeblks 1 1K 1106
vnodes 1 1K 1
ktls 1 1K 1
iov 1 1K 17674

NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
feeder 7 1K 7

loginclass 3 1K 7

prison 6 1K 6
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
apmdev 1 1K 1
atkbddev 2 1K 2
CAM path 4 1K 1034
tcpfunc 2 1K 2

pmchooks 1 1K 1
filecaps 5 1K 72
soname 4 1K 8121

nexusdev 5 1K 5
sctp_vrf 1 1K 1

entropy 2 1K 39

vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1

cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1

pf_table 0 0K 0
pf_rule 0 0K 0
pf_altq 0 0K 0
pf_osfp 0 0K 0
pf_temp 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 0
sctp_iter 0 0K 5
sctp_mvrf 0 0K 0
sctp_cpal 0 0K 0

sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_a_it 0 0K 5

sctp_aadr 0 0K 0
sctp_stri 0 0K 0

ath_hal 0 0K 0
madt_table 0 0K 2
athdev 0 0K 0
ata_pci 0 0K 0
ata_dma 0 0K 0
ata_generic 0 0K 0
amr 0 0K 0
scsi_da 0 0K 69
ata_da 0 0K 0
pvscsi 0 0K 0
smartpqi 0 0K 0
scsi_ch 0 0K 0
scsi_cd 0 0K 0
USBdev 0 0K 0
USB 0 0K 0
AHCI driver 0 0K 0
agp 0 0K 0
iavf 0 0K 0
ixl 0 0K 0
nvme_da 0 0K 0
acpipwr 0 0K 0
twsbuf 0 0K 0
twe_commands 0 0K 0
twa_commands 0 0K 0

tcp_log_dev 0 0K 0

CAM CCB 0 0K 1772

PUC 0 0K 0
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
tempbuff 0 0K 0
UMAHash 0 0K 0
ag_tgt_map_t malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0

savedino 0 0K 13

sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0

sbdep 0 0K 2

jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0

freefrag 0 0K 5

allocindir 0 0K 0
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
xform 0 0K 0
lDevFlags * malloc 0 0K 0
NLM 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0

ip6opt 0 0K 3
ip6_msource 0 0K 0
ip6_moptions 0 0K 0

in6_mfilter 0 0K 0
frag6 0 0K 0
tcplog 0 0K 0
tiDeviceHandle_t * malloc 0 0K 0
LRO 0 0K 0
newreno data 0 0K 0

ip_msource 0 0K 0
ip_moptions 0 0K 0
in_mfilter 0 0K 0

ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
fadvise 0 0K 0
ag_portal_data_t malloc 0 0K 0

statfs 0 0K 1277
export_host 0 0K 0
cl_savebuf 0 0K 2

ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
CCB List 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
CAM ccb queue 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
mps_user 0 0K 0
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
MPSSAS 0 0K 0

mbuf_tag 0 0K 48

accf 0 0K 0
pts 0 0K 0

ioctlops 0 0K 92

Witness 0 0K 0
stack 0 0K 0
mps 0 0K 0
mpr_user 0 0K 0
MPRSAS 0 0K 0
mpr 0 0K 0
mfibuf 0 0K 0
md_sectors 0 0K 0
sbuf 0 0K 288
md_disk 0 0K 0
firmware 0 0K 0
compressor 0 0K 0
malodev 0 0K 0
SWAP 0 0K 0
LED 0 0K 0

sysctltmp 0 0K 608

sysctl 0 0K 1
ekcd 0 0K 0
dumper 0 0K 0

sendfile 0 0K 0

rctl 0 0K 0
ix_sriov 0 0K 0
aacraidcam 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
iirbuf 0 0K 0
cache 0 0K 0
aacraid_buf 0 0K 0

kcovinfo 0 0K 0

prison_racct 0 0K 0
Fail Points 0 0K 0

sigio 0 0K 1

mbuf_cluster 2048 9272 126 9272 0 254 19247104 0
16384 16384 1099 0 2165 0 1 18006016 0
65536 65536 5 107 115 0 1 7340032 0
mbuf_jumbo_page 4096 1098 426 1108 0 254 6242304 0

32768 32768 0 112 112 0 1 3670016 0

sctp_asoc 2288 1098 427 2164 0 254 3489200 0
mbuf_packet 256 8193 951 22486 0 254 2340864 0
2048 2048 1105 15 6686 0 8 2293760 0
16384 16384 5 131 141 0 1 2228224 0
512 512 4267 37 5206 0 30 2203648 0
sctp_ep 1280 1102 422 6492 0 254 1950720 0
BUF TRIE 144 162 13306 430 0 62 1939392 0
4096 4096 335 1 494 0 2 1376256 0
128 128 9253 202 10621 0 126 1210240 0
512 512 2202 54 8681 0 30 1155072 0
UMA Slabs 0 112 10164 18 10164 0 126 1140384 0
sctp_raddr 736 1098 431 2164 0 254 1125344 0
pbuf 832 0 969 0 0 2 806208 0
mbuf 256 2598 198 6475 0 254 715776 0
8192 8192 2 80 112 0 1 671744 0
512 512 1146 30 1175 0 30 602112 0
tcpcb 1040 3 514 7 0 254 537680 0
socket 960 28 480 9877 0 254 487680 0
RADIX NODE 144 2819 230 49196 0 62 439056 0
4096 4096 59 20 2344 0 2 323584 0
256 256 1137 108 3620 0 62 318720 0
VNODE 496 538 94 1630 0 30 313472 0
256 256 1111 74 8810 0 62 303360 0
256 Bucket 2048 139 5 686 0 8 294912 0
VM OBJECT 264 1010 70 29265 0 30 285120 0
THREAD 1792 134 19 2288 0 8 274176 0
ripcb 488 2 510 5 0 254 249856 0
udplite_inpcb 488 2 510 2164 0 254 249856 0
tcp_inpcb 488 3 509 7 0 254 249856 0
udp_inpcb 488 2 510 135 0 254 249856 0
1024 1024 113 103 451 0 16 221184 0
vmem btag 56 3775 28 3775 0 254 212968 0
128 128 1432 149 1568 0 126 202368 0
64 64 2957 130 4806 0 254 197568 0
16 16 11797 453 11865 0 254 196000 0
256 256 652 53 2578 0 62 180480 0
128 128 1210 185 26604 0 126 178560 0

UMA Zones 768 225 2 225 0 16 174336 0

sctp_stream_msg_out 112 1098 450 1098 0 254 173376 0
32 32 4467 447 6793 0 254 157248 0
FFS2 dinode 256 507 63 1597 0 62 145920 0
64 64 1642 437 3842 0 254 133056 0
MAP ENTRY 96 1036 350 61920 0 126 133056 0
65536 65536 2 0 2 0 1 131072 0
65536 65536 0 2 55 0 1 131072 0
2048 2048 9 55 2545 0 8 131072 0
unpcb 256 11 499 1054 0 254 130560 0
ksiginfo 112 54 990 72 0 126 116928 0
16384 16384 3 4 1090 0 1 114688 0
FFS inode 160 507 193 1597 0 62 112000 0
VMSPACE 2536 29 13 1866 0 4 106512 0
S VFS Cache 104 596 418 2232 0 126 105456 0
128 128 518 257 6372 0 126 99200 0
256 256 252 123 4834 0 62 96000 0
PROC 1312 51 21 1885 0 8 94464 0
g_bio 408 0 210 4739 0 30 85680 0
128 Bucket 1024 44 39 604 0 16 84992 0
32 32 2234 412 12480 0 254 84672 0
filedesc0 1080 52 25 1886 0 8 83160 0

UMA Kegs 384 211 5 211 0 30 82944 0

2048 2048 4 36 48 0 8 81920 0
16 16 4417 583 13051 0 254 80000 0
64 64 499 572 760 0 254 68544 0
128 128 347 180 877 0 126 67456 0

65536 65536 1 0 1 0 1 65536 0
65536 65536 1 0 1 0 1 65536 0

65536 65536 0 1 8 0 1 65536 0
32768 32768 2 0 2 0 1 65536 0
4096 4096 12 4 1300 0 2 65536 0
64 Bucket 512 65 39 948 0 30 53248 0
128 128 162 241 1259 0 126 51584 0
32 Bucket 256 42 153 600 0 62 49920 0

DIRHASH 1024 34 14 34 0 16 49152 0

NAMEI 1024 0 48 16396 0 16 49152 0
8192 8192 6 0 6 0 1 49152 0
1024 1024 26 22 26 0 16 49152 0
syncache 168 0 264 5 0 254 44352 0
4096 4096 10 0 10 0 2 40960 0
clpbuf 832 0 48 87 0 16 39936 0
pipe 760 12 38 295 0 16 38000 0
64 pcpu 8 3881 727 3883 0 254 36864 0
selfd 64 38 529 3437 0 254 36288 0
64 64 31 536 13326 0 254 36288 0
64 64 128 439 165 0 254 36288 0
64 64 54 513 1890 0 254 36288 0
64 64 10 557 26 0 254 36288 0
128 128 137 142 625 0 126 35712 0
routing nhops 256 11 124 24 0 62 34560 0

ttyoutq 256 72 63 160 0 62 34560 0

256 256 4 131 2480 0 62 34560 0
256 256 9 126 11 0 62 34560 0
256 256 26 109 73 0 62 34560 0
TURNSTILE 136 154 98 154 0 62 34272 0
SLEEPQUEUE 88 154 230 154 0 126 33792 0
32768 32768 1 0 1 0 1 32768 0
16384 16384 1 1 4 0 1 32768 0
8192 8192 3 1 5 0 1 32768 0
8192 8192 4 0 4 0 1 32768 0
2048 2048 6 10 6 0 8 32768 0
1024 1024 7 25 12 0 16 32768 0
1024 1024 2 30 2166 0 16 32768 0
1024 1024 9 23 9 0 16 32768 0
1024 1024 0 32 918 0 16 32768 0
512 512 15 49 15 0 30 32768 0
512 512 20 44 20 0 30 32768 0
512 512 3 61 7 0 30 32768 0

mt_stats_zone 64 445 67 445 0 254 32768 0

2 Bucket 32 274 734 11099 0 254 32256 0

ttyinq 160 135 65 300 0 62 32000 0

Files 80 106 294 16386 0 126 32000 0

cpuset 104 7 272 7 0 126 29016 0

hostcache 96 1 293 1 0 254 28224 0
PWD 32 13 869 1183 0 254 28224 0
32 32 320 562 2679 0 254 28224 0
4 Bucket 48 7 581 3429 0 254 28224 0
rtentry 208 20 113 24 0 62 27664 0

8192 8192 3 0 3 0 1 24576 0

4096 4096 6 0 7 0 2 24576 0
rl_entry 40 32 574 32 0 254 24240 0
8 Bucket 80 52 248 13132 0 126 24000 0
Mountpoints 2816 2 6 2 0 4 22528 0
udpcb 32 4 626 2299 0 254 20160 0
64 64 2 313 2 0 254 20160 0
32 32 30 600 2390 0 254 20160 0
32 32 60 570 72 0 254 20160 0
32 32 10 620 3221 0 254 20160 0
16 Bucket 144 43 97 141 0 62 20160 0
KNOTE 160 8 117 6970 0 62 20000 0
128 128 0 155 2 0 126 19840 0
procdesc 136 2 143 8 0 62 19720 0
256 256 2 73 2 0 62 19200 0

epoch_record pcpu 256 4 60 4 0 62 16384 0

16384 16384 1 0 1 0 1 16384 0
8192 8192 2 0 2 0 1 16384 0
4096 4096 1 3 7 0 2 16384 0
4096 4096 2 2 2 0 2 16384 0
2048 2048 4 4 4 0 8 16384 0
2048 2048 1 7 1 0 8 16384 0
2048 2048 2 6 2 0 8 16384 0
2048 2048 0 8 1 0 8 16384 0
1024 1024 2 14 5 0 16 16384 0
1024 1024 4 12 4 0 16 16384 0
512 512 0 32 1 0 30 16384 0
512 512 12 20 14 0 30 16384 0
sctp_laddr 48 0 336 7 0 254 16128 0
vtnet_tx_hdr 24 0 668 1077 0 254 16032 0

mt_zone 24 445 223 445 0 254 16032 0

16 16 464 536 1914 0 254 16000 0

KMAP ENTRY 96 12 153 12 0 126 15840 0

kenv 258 3 57 999 0 30 15480 0

FPU_save_area 832 1 17 1 0 16 14976 0
vmem 1856 1 7 1 0 8 14848 0

32 32 86 292 1497 0 254 12096 0
32 32 6 372 6 0 254 12096 0
16 16 11 739 2430 0 254 12000 0
16 16 17 733 131 0 254 12000 0
16 16 27 723 23683 0 254 12000 0
16 16 2 748 2 0 254 12000 0
SMR CPU 32 2 253 2 0 254 8160 0
16 16 9 491 9 0 254 8000 0
SMR SHARED 24 2 253 2 0 254 6120 0

UMA Slabs 1 176 9 13 9 0 62 3872 0

int pcpu 4 34 478 34 0 254 2048 0

FFS1 dinode 128 0 0 0 0 126 0 0
swblk 136 0 0 0 0 62 0 0
swpctrie 144 0 0 0 0 62 0 0

sctp_asconf_ack 48 0 0 0 0 254 0 0

sctp_asconf 40 0 0 0 0 254 0 0

sctp_readq 152 0 0 0 0 254 0 0
sctp_chunk 152 0 0 0 0 254 0 0

pf state scrubs 40 0 0 0 0 254 0 0
pf frag entries 40 0 0 0 0 254 0 0
pf frags 248 0 0 0 0 62 0 0
pf table entries 160 0 0 0 0 62 0 0
pf table entry counters 64 0 0 0 0 254 0 0
pf source nodes 136 0 0 0 0 254 0 0
pf state keys 88 0 0 0 0 126 0 0

pf states 296 0 0 0 0 254 0 0
pf tags 104 0 0 0 0 126 0 0

pf mtags 48 0 0 0 0 254 0 0

tcp_bbr_pcb 832 0 0 0 0 16 0 0
tcp_bbr_map 128 0 0 0 0 126 0 0
tcp_log_node 120 0 0 0 0 126 0 0
tcp_log_bucket 176 0 0 0 0 62 0 0
tcp_log 416 0 0 0 0 254 0 0

tcpreass 48 0 0 0 0 254 0 0
tfo_ccache_entries 80 0 0 0 0 126 0 0

tfo 4 0 0 0 0 254 0 0

sackhole 32 0 0 0 0 254 0 0
tcptw 88 0 0 0 0 254 0 0

ipq 56 0 0 0 0 254 0 0

IPsec SA lft_c 16 0 0 0 0 254 0 0
itimer 352 0 0 0 0 30 0 0
AIOLIO 280 0 0 0 0 30 0 0
AIOCB 752 0 0 0 0 16 0 0
AIOP 32 0 0 0 0 254 0 0
AIO 208 0 0 0 0 62 0 0

TMPFS node 232 0 0 0 0 62 0 0
TMPFS dirent 64 0 0 0 0 254 0 0
NCLNODE 592 0 0 0 0 16 0 0
LTS VFS Cache 360 0 0 0 0 30 0 0
L VFS Cache 320 0 0 0 0 30 0 0
STS VFS Cache 144 0 0 0 0 62 0 0

rentr 24 0 0 0 0 254 0 0
VNODEPOLL 120 0 0 0 0 126 0 0

crypto_session 72 0 0 0 0 126 0 0
cryptop 280 0 0 0 0 30 0 0
nvme_request 128 0 0 0 0 126 0 0
IOMMU_MAP_ENTRY 120 0 0 0 0 126 0 0
ktls_session 192 0 0 0 0 62 0 0
mbuf_jumbo_16k 16384 0 0 0 0 254 0 0
mbuf_jumbo_9k 9216 0 0 0 0 254 0 0
audit_record 1280 0 0 0 0 8 0 0
domainset 40 0 0 0 0 254 0 0
MAC labels 40 0 0 0 0 254 0 0
vnpbuf 832 0 0 0 0 62 0 0
mdpbuf 832 0 0 0 0 4 0 0
nfspbuf 832 0 0 0 0 16 0 0
swwbuf 832 0 0 0 0 8 0 0
swrbuf 832 0 0 0 0 16 0 0
umtx_shm 88 0 0 0 0 126 0 0
umtx pi 96 0 0 0 0 126 0 0
rangeset pctrie nodes 144 0 0 0 0 62 0 0
65536 65536 0 0 0 0 1 0 0
65536 65536 0 0 0 0 1 0 0

32768 32768 0 0 0 0 1 0 0
32768 32768 0 0 0 0 1 0 0
32768 32768 0 0 0 0 1 0 0
32768 32768 0 0 0 0 1 0 0
32768 32768 0 0 0 0 1 0 0
16384 16384 0 0 0 0 1 0 0
16384 16384 0 0 0 0 1 0 0
16384 16384 0 0 0 0 1 0 0

8192 8192 0 0 0 0 1 0 0
8192 8192 0 0 0 0 1 0 0
4096 4096 0 0 0 0 2 0 0

fakepg 104 0 0 0 0 126 0 0
UMA Hash 256 0 0 0 0 62 0 0

db>

syzbot

unread,

Sep 8, 2020, 3:14:16 AM9/8/20

to syzkaller-f...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: 964bd353 vm_object_split(): Handle orig_object type changes.
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=16c841ed900000

dashboard link: https://syzkaller.appspot.com/bug?extid=125df5bf9ae3bf9a206d
userspace arch: i386

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1085680d900000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=141e51a5900000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+125df5...@syzkaller.appspotmail.com

Fatal trap 9: general protection fault while in kernel mode

cpuid = 0; apic id = 00

instruction pointer = 0x20:0xffffffff82dab7a3
stack pointer = 0x0:0xfffffe00261a45c0
frame pointer = 0x0:0xfffffe00261a47a0

code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0

current process = 1092 (syz-executor8752436)

trap number = 9
panic: general protection fault

cpuid = 0
time = 1599548576
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe00261a4290
vpanic() at vpanic+0x1c7/frame 0xfffffe00261a42f0
panic() at panic+0x43/frame 0xfffffe00261a4350
trap_fatal() at trap_fatal+0x4cd/frame 0xfffffe00261a43d0
trap() at trap+0xf7/frame 0xfffffe00261a44f0
calltrap() at calltrap+0x8/frame 0xfffffe00261a44f0
--- trap 0x9, rip = 0xffffffff82dab7a3, rsp = 0xfffffe00261a45c0, rbp = 0xfffffe00261a47a0 ---
sctp_lower_sosend() at sctp_lower_sosend+0x54d3/frame 0xfffffe00261a47a0
sctp_sosend() at sctp_sosend+0x4fc/frame 0xfffffe00261a48d0
sosend() at sosend+0xc6/frame 0xfffffe00261a4940
kern_sendit() at kern_sendit+0x34b/frame 0xfffffe00261a49f0
sendit() at sendit+0x226/frame 0xfffffe00261a4a50
sys_sendto() at sys_sendto+0x5c/frame 0xfffffe00261a4ab0
ia32_syscall() at ia32_syscall+0x24e/frame 0xfffffe00261a4bf0
int0x80_syscall_common() at int0x80_syscall_common+0x9c/frame 0xfbffcf7c
KDB: enter: panic
[ thread pid 1092 tid 100716 ]
Stopped at kdb_enter+0x67: movq $0,0x1487e36(%rip)

db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0
rax 0x12

rcx 0x80 ll+0x5f
rdx 0xffffffff818e6417
rbx 0
rsp 0xfffffe00261a4270
rbp 0xfffffe00261a4290
rsi 0x1
rdi 0

r8 0
r9 0xffffffff
r10 0

r11 0xfffffe00264bef10

r12 0xffffffff82068ef0 ddb_dbbe
r13 0

r14 0xffffffff81930983
r15 0xffffffff81930983
rip 0xffffffff810ce2c7 kdb_enter+0x67
rflags 0x200082 kernphys+0x82
kdb_enter+0x67: movq $0,0x1487e36(%rip)
db> show proc
Process 1092 (syz-executor8752436) at 0xfffff80004c71000:

state: NORMAL
uid: 0 gids: 0, 0, 5

parent: pid 788 at 0xfffff800196a0000
ABI: FreeBSD ELF32
arguments: ./syz-executor875243657
reaper: 0xfffff80004304000 reapsubtree: 1
sigparent: 20
vmspace: 0xfffffe002658d000
(map 0xfffffe002658d000)
(map.pmap 0xfffffe002658d0c0)
(pmap 0xfffffe002658d120)
threads: 3
100098 S nanslp 0xffffffff82529861 syz-executor8752436
100716 Run CPU 0 syz-executor8752436
100717 S uwait 0xfffff80004e55000 syz-executor8752436

db> ps
pid ppid pgrp uid state wmesg wchan cmd

1093 785 781 0 R (threaded) syz-executor8752436
100104 Run CPU 1 syz-executor8752436
100718 S sbwait 0xfffff80004f3ae2c syz-executor8752436
1092 788 781 0 R (threaded) syz-executor8752436
100098 S nanslp 0xffffffff82529861 syz-executor8752436
100716 Run CPU 0 syz-executor8752436
100717 S uwait 0xfffff80004e55000 syz-executor8752436
1091 784 781 0 S (threaded) syz-executor8752436
100081 S nanslp 0xffffffff82529861 syz-executor8752436
100713 S sbwait 0xfffff80004f3a2ec syz-executor8752436
100715 S uwait 0xfffff80004b95080 syz-executor8752436
1090 787 781 0 R (threaded) syz-executor8752436
100082 RunQ syz-executor8752436
100711 S sbwait 0xfffff80004f3c2ec syz-executor8752436
100714 S uwait 0xfffff8000463c800 syz-executor8752436
788 783 781 0 R syz-executor8752436
787 783 781 0 R syz-executor8752436
785 783 781 0 S nanslp 0xffffffff82529861 syz-executor8752436
784 783 781 0 R syz-executor8752436
783 781 781 0 S nanslp 0xffffffff82529860 syz-executor8752436
781 779 781 0 Ss pause 0xfffff80004dea0a8 csh
779 682 779 0 Ss select 0xfffff80004b959c0 sshd
744 1 744 0 Ss+ ttyin 0xfffff8000495ccb0 getty
743 1 743 0 Ss+ ttyin 0xfffff8000495a0b0 getty
742 1 742 0 Ss+ ttyin 0xfffff8000495a4b0 getty
741 1 741 0 Ss+ ttyin 0xfffff8000495a8b0 getty
740 1 740 0 Ss+ ttyin 0xfffff8000495acb0 getty
739 1 739 0 Ss+ ttyin 0xfffff800049590b0 getty
738 1 738 0 Ss+ ttyin 0xfffff800049594b0 getty
737 1 737 0 Ss+ ttyin 0xfffff800049598b0 getty
736 1 736 0 Ss+ ttyin 0xfffff80004959cb0 getty
686 1 686 0 Ss nanslp 0xffffffff82529860 cron
682 1 682 0 Ss select 0xfffff80004b956c0 sshd
495 1 495 0 Ss select 0xfffff80004e55940 syslogd
424 1 424 0 Ss select 0xfffff80004e55b40 devd
423 1 423 65 Ss select 0xfffff80004e558c0 dhclient
338 1 338 0 Ss select 0xfffff80004e42840 dhclient
335 1 335 0 Ss select 0xfffff80004e427c0 dhclient
23 0 0 0 DL syncer 0xffffffff82616968 [syncer]
22 0 0 0 DL vlruwt 0xfffff80004cbc000 [vnlru]

21 0 0 0 DL (threaded) [bufdaemon]

100070 D qsleep 0xffffffff82615cb0 [bufdaemon]

100077 D - 0xffffffff8200aa00 [bufspacedaemon-0]

100086 D sdflush 0xfffff80004e6ace8 [/ worker]
20 0 0 0 DL psleep 0xffffffff8263cec8 [vmdaemon]

19 0 0 0 DL (threaded) [pagedaemon]

100068 D psleep 0xffffffff82631378 [dom0]
100075 D launds 0xffffffff82631384 [laundry: dom0]
100076 D umarcl 0xffffffff814d20e0 [uma]
18 0 0 0 RL [rand_harvestq]
17 0 0 0 DL waiting 0xffffffff82e0f2f8 [sctp_iterator]
16 0 0 0 RL [pf purge]
15 0 0 0 DL - 0xffffffff826152ac [soaiod4]
9 0 0 0 DL - 0xffffffff826152ac [soaiod3]
8 0 0 0 DL - 0xffffffff826152ac [soaiod2]
7 0 0 0 DL - 0xffffffff826152ac [soaiod1]

6 0 0 0 DL (threaded) [cam]

100034 D - 0xffffffff822351c0 [doneq0]
100067 D - 0xffffffff82235090 [scanner]
5 0 0 0 DL crypto_ 0xfffff800044cb090 [crypto returns 1]
4 0 0 0 DL crypto_ 0xfffff800044cb030 [crypto returns 0]
3 0 0 0 DL crypto_ 0xffffffff8262e860 [crypto]
14 0 0 0 DL seqstat 0xfffff80004499c88 [sequencer 00]

13 0 0 0 DL (threaded) [geom]

100025 D - 0xffffffff825087d0 [g_event]
100026 D - 0xffffffff825087d8 [g_up]
100027 D - 0xffffffff825087e0 [g_down]

2 0 0 0 DL (threaded) [KTLS]

100018 D - 0xfffff80004331800 [thr_0]
100019 D - 0xfffff80004331880 [thr_1]

12 0 0 0 WL (threaded) [intr]

100011 I [swi5: fast taskq]
100015 I [swi6: task queue]
100016 I [swi6: Giant taskq]
100020 I [swi1: netisr 0]
100021 I [swi3: vm]
100022 I [swi4: clock (0)]
100023 I [swi4: clock (1)]

100035 I [irq24: virtio_pci0]
100036 I [irq25: virtio_pci0]
100037 I [irq26: virtio_pci0]
100038 I [irq27: virtio_pci0]
100039 I [irq28: virtio_pci1]
100040 I [irq29: virtio_pci1]
100041 I [irq30: virtio_pci1]
100042 I [irq31: virtio_pci1]
100043 I [irq32: virtio_pci1]
100048 I [irq10: virtio_pci2]
100050 I [irq1: atkbd0]
100051 I [irq12: psm0]
100052 I [swi0: uart uart++]
100060 I [swi1: pf send]
100073 I [swi1: hpts]
100074 I [swi1: hpts]
11 0 0 0 RL (threaded) [idle]
100003 CanRun [idle: cpu0]
100004 CanRun [idle: cpu1]

1 0 1 0 SLs wait 0xfffff80004304000 [init]
10 0 0 0 DL audit_w 0xffffffff8262ed80 [audit]

0 0 0 0 DLs (threaded) [kernel]

100000 D swapin 0xffffffff82508d70 [swapper]
100005 D - 0xfffff800040e3100 [if_io_tqg_0]
100006 D - 0xfffff800040e2d00 [if_io_tqg_1]
100007 D - 0xfffff800040e2c00 [if_config_tqg_0]
100008 D - 0xfffff800040e2b00 [softirq_0]
100009 D - 0xfffff800040e2a00 [softirq_1]
100010 D - 0xfffff80004334100 [thread taskq]
100012 D - 0xfffff80004331e00 [inm_free taskq]
100013 D - 0xfffff80004331d00 [kqueue_ctx taskq]
100014 D - 0xfffff80004331c00 [aiod_kick taskq]
100017 D - 0xfffff80004331900 [in6m_free taskq]
100024 D - 0xfffff80004331700 [firmware taskq]
100029 D - 0xfffff80004331600 [crypto_0]
100030 D - 0xfffff80004331600 [crypto_1]
100044 D - 0xfffff80004331300 [vtnet0 rxq 0]
100045 D - 0xfffff80004331200 [vtnet0 txq 0]
100046 D - 0xfffff80004331100 [vtnet0 rxq 1]
100047 D - 0xfffff80004331000 [vtnet0 txq 1]
100049 D vtbslp 0xfffff800046a9a00 [virtio_balloon]
100053 D - 0xfffff80004332c00 [mca taskq]
100057 D - 0xffffffff81cd64e1 [deadlkres]
100062 D - 0xfffff80004332800 [acpi_task_0]
100063 D - 0xfffff80004332800 [acpi_task_1]
100064 D - 0xfffff80004332800 [acpi_task_2]
100066 D - 0xfffff80004331400 [CAM taskq]
db> show all locks
Process 1092 (syz-executor8752436) thread 0xfffffe00264bea00 (100716)
exclusive sleep mutex sctp-send-tcb (tcbs) r = 0 (0xfffffe00265551c0) locked @ /syzkaller/managers/i386/kernel/sys/netinet/sctp_output.c:13094

db> show malloc
Type InUse MemUse Requests
pf_hash 5 11524K 5

devbuf 4214 4854K 4242

tcp_hpts 5 3201K 5
vtbuf 24 1968K 46

sysctloid 28164 1643K 28228
kobj 335 1340K 494
newblk 102 1050K 487
vfscache 4 1025K 4
pcb 29 546K 687
inodedep 2 513K 78

ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 472K 4

subproc 109 233K 1152

acpica 1674 185K 52414
vnet_data 1 168K 1

pagedep 2 129K 22

tfo_ccache 1 128K 1
sem 4 106K 4

DEVFS1 101 101K 110
linker 254 99K 282
bus 975 79K 3020

mtx_pool 2 72K 2
syncache 1 68K 1
acpitask 1 64K 1
ddb_capture 1 64K 1
module 505 64K 505

umtx 288 36K 288
temp 18 33K 1558

hostcache 1 32K 1
shm 1 32K 1

kdtrace 164 32K 2854
msg 4 30K 4
DEVFS3 120 30K 130
DEVFS_RULE 56 27K 56
vmem 3 26K 4

gtaskqueue 18 26K 18
kbdmux 6 22K 6

BPF 10 18K 10

ufs_mount 5 17K 6
proc 3 17K 3
tty 16 16K 16
tidhash 1 16K 1
ithread 99 16K 99
bus-sc 30 14K 1405

ifaddr 32 13K 32
KTRACE 100 13K 100

kenv 92 12K 92
eventhandler 132 12K 132

pfs_nodes 20 10K 20
GEOM 60 10K 489

rman 82 10K 423
sctp_timw 34 9K 34
bmsafemap 2 9K 43

UART 12 9K 12
devstat 4 9K 4
rpc 2 8K 2

shmfd 1 8K 1

pfs_vncache 1 8K 1
audit_evclass 233 8K 291

sctp_atcl 12 6K 918

CAM DEV 3 6K 510

vt 11 6K 11

sglist 5 6K 5
CAM queue 5 6K 1528
taskqueue 48 6K 48

cred 20 5K 279
ufs_dirhash 24 5K 24
ifnet 3 5K 3
UMA 251 5K 251
sctp_stro 4 4K 611

memdesc 1 4K 1
MCA 32 4K 32

plimit 16 4K 398
evdev 4 4K 4
filedesc 1 4K 1
lltable 11 4K 11
routetbl 15 4K 15
hhook 13 4K 13
kqueue 51 4K 1096
ether_multi 40 4K 45
pf_ifnet 5 3K 6
in6_multi 25 3K 25

acpisem 22 3K 22
terminal 11 3K 11

session 19 3K 36
pgrp 19 3K 36
uidinfo 3 3K 12
sctp_stri 4 2K 612

local_apic 1 2K 1
io_apic 1 2K 1
ipsec-saq 2 2K 2

select 16 2K 16
lockf 16 2K 29

CAM XPT 22 2K 543

Unitno 26 2K 38
proc-args 36 2K 491

ipsecpolicy 2 2K 2
acpidev 20 2K 20
msi 9 2K 9
clone 9 2K 9

softdep 1 1K 1

sahead 1 1K 1
secasvar 1 1K 1

vnodemarker 2 1K 48

NFSD session 1 1K 1
CAM periph 4 1K 271

sctp_atky 16 1K 1530
ipsec 3 1K 3
nhops 6 1K 6

toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 89
pci_link 10 1K 10

sctp_ifa 5 1K 7
ip6ndp 4 1K 5

encap_export_host 12 1K 12
crypto 3 1K 3

in_multi 2 1K 3

pfil 4 1K 4
chacha20random 1 1K 1
CAM SIM 2 1K 2
cdev 2 1K 2

osd 3 1K 9
sctp_ifn 2 1K 7
indirdep 1 1K 3
mld 2 1K 2
igmp 2 1K 2
vnodes 1 1K 1

ktls 1 1K 1
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
feeder 7 1K 7

sctp_athm 12 1K 1224
inpcbpolicy 6 1K 131

loginclass 3 1K 7
prison 6 1K 6

soname 8 1K 6865
sctp_map 8 1K 612

CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
apmdev 1 1K 1
atkbddev 2 1K 2
CAM path 4 1K 1034

freework 1 1K 26
diradd 1 1K 42

tcpfunc 2 1K 2
pmchooks 1 1K 1

DEVFSP 2 1K 2
tun 3 1K 3

nexusdev 5 1K 5
sctp_vrf 1 1K 1

entropy 2 1K 38

vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1

cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1

filecaps 1 1K 71
sctp_mcore 0 0K 0
sctp_socko 0 0K 611
sctp_iter 0 0K 3
sctp_mvrf 0 0K 0
sctp_cpal 0 0K 0

sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0

sctp_a_it 0 0K 3
sctp_aadr 0 0K 0

pf_table 0 0K 0
pf_rule 0 0K 0
pf_altq 0 0K 0

pf_osfp 0 0K 0
pf_temp 0 0K 0
vtfont 0 0K 0
madt_table 0 0K 2
ath_hal 0 0K 0

athdev 0 0K 0
ata_pci 0 0K 0
ata_dma 0 0K 0
ata_generic 0 0K 0
amr 0 0K 0
scsi_da 0 0K 69

pvscsi 0 0K 0
smartpqi 0 0K 0

ata_da 0 0K 0

scsi_ch 0 0K 0
scsi_cd 0 0K 0
USBdev 0 0K 0
USB 0 0K 0
AHCI driver 0 0K 0
agp 0 0K 0
iavf 0 0K 0
ixl 0 0K 0
nvme_da 0 0K 0
acpipwr 0 0K 0
twsbuf 0 0K 0
twe_commands 0 0K 0
twa_commands 0 0K 0

ice-resmgr 0 0K 0
ice-osdep 0 0K 0
ice 0 0K 0
fpukern_ctx 0 0K 0

tcp_log_dev 0 0K 0

xen_intr 0 0K 0
midi buffers 0 0K 0
mixer 0 0K 0
xen_hvm 0 0K 0
legacydrv 0 0K 0
qpidrv 0 0K 0
ac97 0 0K 0

dmar_idpgtbl 0 0K 0
dmar_dom 0 0K 0
dmar_ctx 0 0K 0

hdacc 0 0K 0

hdac 0 0K 0
hdaa 0 0K 0

isci 0 0K 0
iommu_dmamap 0 0K 0

acpi_perf 0 0K 0

hyperv_socket 0 0K 0
bxe_ilt 0 0K 0
xenbus 0 0K 0
acpicmbat 0 0K 0
SIIS driver 0 0K 0
vm_fictitious 0 0K 0

CAM CCB 0 0K 1896

savedino 0 0K 18

sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0

sbdep 0 0K 7

jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0

newdirblk 0 0K 8
dirrem 0 0K 31
mkdir 0 0K 16
freefile 0 0K 26
freeblks 0 0K 25
freefrag 0 0K 7

ip6opt 0 0K 3
ip6_msource 0 0K 0
ip6_moptions 0 0K 0

in6_mfilter 0 0K 0
frag6 0 0K 0
tcplog 0 0K 0
tiDeviceHandle_t * malloc 0 0K 0
LRO 0 0K 0
newreno data 0 0K 0

ip_msource 0 0K 0
ip_moptions 0 0K 0
in_mfilter 0 0K 0

statfs 0 0K 211
export_host 0 0K 0
cl_savebuf 0 0K 3

mbuf_tag 0 0K 25

accf 0 0K 0
pts 0 0K 0

iov 0 0K 13165
ioctlops 0 0K 84

sysctltmp 0 0K 592

sysctl 0 0K 1
ekcd 0 0K 0
dumper 0 0K 0

sendfile 0 0K 0

rctl 0 0K 0
ix_sriov 0 0K 0
aacraidcam 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
iirbuf 0 0K 0
cache 0 0K 0
aacraid_buf 0 0K 0

kcovinfo 0 0K 0

prison_racct 0 0K 0
Fail Points 0 0K 0

sigio 0 0K 1

db> show uma
Zone Size Used Free Requests Sleeps Bucket Total Mem XFree

mbuf_cluster 2048 9272 126 9272 0 254 19247104 0

mbuf_jumbo_page 4096 3188 1384 278040 0 254 18726912 0
65536 65536 0 110 155 0 1 7208960 0

32768 32768 0 112 112 0 1 3670016 0

mbuf_packet 256 8198 946 28108 0 254 2340864 0
16384 16384 4 134 143 0 1 2260992 0
512 512 4120 24 4120 0 30 2121728 0
mbuf 256 5309 2572 857173 0 254 2017536 0
BUF TRIE 144 161 13307 542 0 62 1939392 0
4096 4096 335 1 494 0 2 1376256 0
UMA Slabs 0 112 11479 35 11479 0 126 1289568 0
128 128 9251 204 9291 0 126 1210240 0
sctp_asoc 2288 4 506 306 0 254 1166880 0
DEVCTL 1024 0 1000 109 0 16 1024000 0

pbuf 832 0 969 0 0 2 806208 0

8192 8192 8 77 117 0 1 696320 0
sctp_ep 1280 4 506 306 0 254 652800 0

tcpcb 1040 3 514 7 0 254 537680 0

socket 960 18 490 1498 0 254 487680 0
RADIX NODE 144 2466 219 43351 0 62 386640 0
sctp_raddr 736 4 513 306 0 254 380512 0
256 Bucket 2048 157 27 3118 0 8 376832 0
VNODE 496 520 56 548 0 30 285696 0
4096 4096 13 52 92 0 2 266240 0
65536 65536 4 0 4 0 1 262144 0
VM OBJECT 264 920 70 16322 0 30 261360 0
THREAD 1792 114 30 718 0 8 258048 0
ripcb 488 1 511 4 0 254 249856 0
tcp_inpcb 488 3 509 7 0 254 249856 0
udp_inpcb 488 2 510 120 0 254 249856 0
4096 4096 51 3 1094 0 2 221184 0
64 64 2906 181 3836 0 254 197568 0
16 16 11870 380 14005 0 254 196000 0
128 128 1250 269 30316 0 126 194432 0
256 256 330 360 2798 0 62 176640 0
512 512 4 340 435 0 30 176128 0
UMA Zones 768 226 1 226 0 16 174336 0
32 32 4463 451 5848 0 254 157248 0
1024 1024 11 141 1061 0 16 155648 0
vmem btag 56 2238 414 2238 0 254 148512 0
FFS2 dinode 256 491 79 517 0 62 145920 0
128 128 953 132 1903 0 126 138880 0

65536 65536 2 0 2 0 1 131072 0

65536 65536 2 0 2 0 1 131072 0
65536 65536 0 2 8 0 1 131072 0
1024 1024 101 27 113 0 16 131072 0
unpcb 256 7 503 1044 0 254 130560 0
ksiginfo 112 37 1007 73 0 126 116928 0
MAP ENTRY 96 867 267 42779 0 126 108864 0
S VFS Cache 104 591 423 1324 0 126 105456 0
2048 2048 10 38 2971 0 8 98304 0
FFS inode 160 491 84 517 0 62 92000 0
VMSPACE 2536 28 8 1073 0 4 91296 0
128 Bucket 1024 43 40 213 0 16 84992 0
filedesc0 1080 51 26 1094 0 8 83160 0
UMA Kegs 384 212 4 212 0 30 82944 0
2048 2048 6 34 52 0 8 81920 0
sctp_readq 152 3 517 305 0 254 79040 0
sctp_chunk 152 36 484 17997 0 254 79040 0
512 512 64 88 186 0 30 77824 0
PROC 1312 50 7 1093 0 8 74784 0
g_bio 408 0 180 5238 0 30 73440 0
64 64 535 536 14468 0 254 68544 0
128 128 321 206 506 0 126 67456 0

65536 65536 1 0 1 0 1 65536 0

32768 32768 2 0 2 0 1 65536 0

512 512 31 89 2054 0 30 61440 0
512 512 78 42 79 0 30 61440 0
sctp_stream_msg_out 112 4 536 306 0 254 60480 0
256 256 57 153 699 0 62 53760 0
64 Bucket 512 63 41 801 0 30 53248 0
64 64 529 290 1799 0 254 52416 0
256 256 132 63 152 0 62 49920 0
32 Bucket 256 51 144 414 0 62 49920 0

DIRHASH 1024 34 14 34 0 16 49152 0

NAMEI 1024 0 48 12124 0 16 49152 0
16384 16384 3 0 3 0 1 49152 0
4096 4096 11 1 11 0 2 49152 0
1024 1024 9 39 630 0 16 49152 0
syncache 168 0 264 5 0 254 44352 0
4096 4096 7 3 398 0 2 40960 0
clpbuf 832 0 48 112 0 16 39936 0
selfd 64 35 532 6635 0 254 36288 0
64 64 18 549 42 0 254 36288 0
64 64 74 493 1144 0 254 36288 0
64 64 128 439 130 0 254 36288 0
64 64 26 541 304 0 254 36288 0
128 128 27 252 45 0 126 35712 0
128 128 16 263 25 0 126 35712 0
128 128 84 195 86 0 126 35712 0
128 128 13 266 330 0 126 35712 0
routing nhops 256 10 125 18 0 62 34560 0

ttyoutq 256 72 63 160 0 62 34560 0

256 256 14 121 75 0 62 34560 0
256 256 25 110 25 0 62 34560 0
256 256 51 84 622 0 62 34560 0
256 256 14 121 585 0 62 34560 0
32768 32768 1 0 1 0 1 32768 0
8192 8192 4 0 4 0 1 32768 0
8192 8192 3 1 5 0 1 32768 0
2048 2048 5 11 5 0 8 32768 0
1024 1024 2 30 6 0 16 32768 0
1024 1024 17 15 17 0 16 32768 0
1024 1024 12 20 12 0 16 32768 0
512 512 1 63 20 0 30 32768 0
512 512 20 44 20 0 30 32768 0
512 512 4 60 5 0 30 32768 0

mt_stats_zone 64 445 67 445 0 254 32768 0

64 pcpu 8 3784 312 3786 0 254 32768 0

ttyinq 160 135 65 300 0 62 32000 0

cpuset 104 7 272 7 0 126 29016 0

sctp_laddr 48 0 588 4 0 254 28224 0
hostcache 96 1 293 1 0 254 28224 0
32 32 277 605 347 0 254 28224 0
4 Bucket 48 12 576 8147 0 254 28224 0
KMAP ENTRY 96 12 279 12 0 126 27936 0
pipe 760 6 29 290 0 16 26600 0
TURNSTILE 136 145 44 145 0 62 25704 0
rtentry 176 14 124 18 0 62 24288 0
rl_entry 40 27 579 27 0 254 24240 0
Files 80 69 231 6810 0 126 24000 0
8 Bucket 80 44 256 7821 0 126 24000 0

Mountpoints 2816 2 6 2 0 4 22528 0

SLEEPQUEUE 88 145 111 145 0 126 22528 0
udpcb 32 2 628 120 0 254 20160 0
PWD 32 10 620 107 0 254 20160 0
64 64 1 314 2 0 254 20160 0
32 32 7 623 10 0 254 20160 0
32 32 11 619 138 0 254 20160 0
32 32 63 567 681 0 254 20160 0
32 32 45 585 4383 0 254 20160 0
32 32 41 589 203 0 254 20160 0
16 Bucket 144 57 83 162 0 62 20160 0
2 Bucket 32 280 350 8606 0 254 20160 0
procdesc 136 1 144 6 0 62 19720 0
256 256 21 54 367 0 62 19200 0

epoch_record pcpu 256 4 60 4 0 62 16384 0

16384 16384 1 0 1 0 1 16384 0
8192 8192 2 0 2 0 1 16384 0
8192 8192 2 0 2 0 1 16384 0

4096 4096 2 2 214 0 2 16384 0
2048 2048 1 7 1 0 8 16384 0

2048 2048 1 7 1 0 8 16384 0

2048 2048 2 6 2 0 8 16384 0
2048 2048 6 2 197 0 8 16384 0
1024 1024 7 9 8 0 16 16384 0
1024 1024 7 9 7 0 16 16384 0
vtnet_tx_hdr 24 0 668 1247 0 254 16032 0

mt_zone 24 445 223 445 0 254 16032 0

kenv 258 3 57 996 0 30 15480 0

FPU_save_area 832 1 17 1 0 16 14976 0
vmem 1856 1 7 1 0 8 14848 0

32 32 97 281 205 0 254 12096 0
KNOTE 160 0 75 8 0 62 12000 0
16 16 25 725 64 0 254 12000 0
16 16 288 462 476 0 254 12000 0
16 16 180 570 1228 0 254 12000 0
16 16 24 726 24169 0 254 12000 0
16 16 7 743 624 0 254 12000 0

8192 8192 1 0 1 0 1 8192 0
8192 8192 1 0 1 0 1 8192 0

4096 4096 1 1 1 0 2 8192 0

SMR CPU 32 2 253 2 0 254 8160 0

16 16 0 500 4 0 254 8000 0
16 16 16 484 18 0 254 8000 0
SMR SHARED 24 2 253 2 0 254 6120 0
UMA Slabs 1 176 8 14 8 0 62 3872 0
int pcpu 4 34 478 34 0 254 2048 0

FFS1 dinode 128 0 0 0 0 126 0 0
swblk 136 0 0 0 0 62 0 0
swpctrie 144 0 0 0 0 62 0 0

sctp_asconf_ack 48 0 0 0 0 254 0 0

sctp_asconf 40 0 0 0 0 254 0 0
pf state scrubs 40 0 0 0 0 254 0 0
pf frag entries 40 0 0 0 0 254 0 0
pf frags 248 0 0 0 0 62 0 0
pf table entries 160 0 0 0 0 62 0 0
pf table entry counters 64 0 0 0 0 254 0 0
pf source nodes 136 0 0 0 0 254 0 0
pf state keys 88 0 0 0 0 126 0 0

pf states 296 0 0 0 0 254 0 0
pf tags 104 0 0 0 0 126 0 0

pf mtags 48 0 0 0 0 254 0 0

tcp_bbr_pcb 832 0 0 0 0 16 0 0
tcp_bbr_map 128 0 0 0 0 126 0 0
udplite_inpcb 488 0 0 0 0 254 0 0
tcp_log_node 120 0 0 0 0 126 0 0
tcp_log_bucket 176 0 0 0 0 62 0 0
tcp_log 416 0 0 0 0 254 0 0

tcpreass 48 0 0 0 0 254 0 0
tfo_ccache_entries 80 0 0 0 0 126 0 0

tfo 4 0 0 0 0 254 0 0

sackhole 32 0 0 0 0 254 0 0
tcptw 88 0 0 0 0 254 0 0

ipq 56 0 0 0 0 254 0 0

IPsec SA lft_c 16 0 0 0 0 254 0 0
itimer 352 0 0 0 0 30 0 0
AIOLIO 280 0 0 0 0 30 0 0
AIOCB 752 0 0 0 0 16 0 0
AIOP 32 0 0 0 0 254 0 0
AIO 208 0 0 0 0 62 0 0

TMPFS node 232 0 0 0 0 62 0 0
TMPFS dirent 64 0 0 0 0 254 0 0
NCLNODE 592 0 0 0 0 16 0 0

rentr 24 0 0 0 0 254 0 0

LTS VFS Cache 360 0 0 0 0 30 0 0
L VFS Cache 320 0 0 0 0 30 0 0
STS VFS Cache 144 0 0 0 0 62 0 0

VNODEPOLL 120 0 0 0 0 126 0 0

32768 32768 0 0 0 0 1 0 0
32768 32768 0 0 0 0 1 0 0
32768 32768 0 0 0 0 1 0 0
32768 32768 0 0 0 0 1 0 0
32768 32768 0 0 0 0 1 0 0
16384 16384 0 0 0 0 1 0 0
16384 16384 0 0 0 0 1 0 0
16384 16384 0 0 0 0 1 0 0
16384 16384 0 0 0 0 1 0 0
16384 16384 0 0 0 0 1 0 0

8192 8192 0 0 0 0 1 0 0

4096 4096 0 0 0 0 2 0 0

2048 2048 0 0 0 0 8 0 0

Reply all

Reply to author

Forward

0 new messages